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The Listing of the Claims: 

1-3. (Cancelled) 

4. (Currently Amended) The method of claim 2 wherein the attribute in the second defining step 
is a binding supported by the web service. A method facilitating the classification of web 
services network traffic, comprising: 

discovering, at a network device, one or more web services based on web service 
invocation messages received at the network device; 

maintaining a tracking list data structure comprising, for each discovered web service, a 
web service identifier corresponding to the web service and a transaction count associated with 
the web service; 

incrementing, responsive to a message indicating a new web services network 
transaction, a transaction count associated with the web service identified in the message; 

presenting, in a user interface, one or more of the web service identifiers and 
corresponding transaction counts, wherein the user interface allows for selection of one or more 
web service identifiers; and 

configuring, responsive to selection of a web service identifier, a network traffic 
classification mechanism to identify the web service corresponding to the web service identifier, 
comprising: 

creating a traffic class identifier corresponding to the web service; 

creating at least one matching rule defining an attribute of the web service; 

associating the at least one matching rule to the traffic class identifier in the traffic 
classification mechanism; 

receiving an interface definition document defining the attributes of the web 
service; 

processing the interface definition document to identify at least one traffic class 
corresponding to the web service, comprising: 

defining a first traffic class corresponding to the web service; 
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defining at least a second traffic class corresponding to a binding 
supported by the web service; and 

associating at least the second traffic class as a child traffic class of the 
first traffic class in a hierarchical traffic classification scheme; and 
configuring a network traffic classification mechanism to identify the at least one 
traffic class based on at least one attribute obtained from the web services definition 
document. 

5. (Currently Amended) The method of claim [[20]] 6 wherein the web services interface 
definition document is a WSDL document. 

6. (Currently Amended) A method facilitating the classification of web services network traffic, 
comprising: 

discovering, at a network device, one or more web services based on web service 
invocation messages received at the network device; 

maintaining a tracking list data structure comprising, for each discovered web service, a 
web service identifier corresponding to the web service and a transaction count associated with 
the web service; 

incrementing, responsive to a message indicating a new web services network 
transaction, a transaction count associated with the web service identified in the message; 

presenting, in a user interface, one or more of the web service identifiers and 
corresponding transaction counts, wherein the user interface allows for selection of one or more 
web service identifiers; and 

configuring, responsive to selection of a web service identifier, a network traffic 
classification mechanism to identify the web service corresponding to the web service identifier^ 
comprising: by 

creating a traffic class identifier corresponding to the web service; 
creating at least one matching rule defining an attribute of the web service; 
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associating the at least one matching rule to the traffic class identifier in the traffic 
classification mechanism; 

receiving an interface definition document defining the attributes of the web 
service; 

processing the interface definition document to identify at least one traffic class 
corresponding to the web service, comprising: 

defining a first traffic class corresponding to the web service; 

defining at least a second traffic class corresponding to an operation of the 
web service; and 

associating at least the second traffic class as a child traffic class of the 
first traffic class in a hierarchical traffic classification scheme; and 
configuring a network traffic classification mechanism to identify the at least one 

traffic class based on at least one attribute obtained from the web services definition 

document . 

7. (Cancelled) 

8. (Previously Presented) The method of claim 6 wherein the attribute in the second creating 
step is the web service identifier corresponding to the web service. 

9. (Original) The method of claim 8 further comprising creating at least one additional 
matching rule defining an attribute of the web service. 

10. (Original) The method of claim 9 wherein the attribute in the third creating step is a 
protocol associated with the web service. 

1 1 . (Original) The method of claim 10 wherein the protocol is a web services protocol. 

12. (Original) The method of claim 10 wherein the protocol is the SOAP protocol. 
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13. (Original) The method of claim 10 wherein the protocol is the HTTP protocol. 

14. (Previously Presented) The method of claim 6 further comprising maintaining a count of a 
number of data flows corresponding to each web service traversing the communications path. 

15. (Original) The method of claim 6 wherein the web service identifier comprises a host name. 

16. (Original) The method of claim 6 wherein the web service identifier comprises a host name 
and a uniform resource indicator. 

17. (Original) The method of claim 6 wherein the configuring step is performed in response to a 
command from an end user. 

18. (Original) The method of claim 6 wherein the monitoring step comprises 

upon detection of a new data flow, 

parsing at least one packet in the data flow to identify the protocol attributes 
corresponding to the data flow; 

matching the identified protocol attributes to a predetermined set of web services 
protocol attributes to determine whether the data flow is web services web services data flow. 

19. (Original) The method of claim 18 wherein the parsing step comprises parsing the at least 
one packet in the data flow into a flow specification, wherein the flow specification contains at 
least one instance of any one of the following: a protocol family designation, a direction of 
packet flow designation, a protocol type designation, a binding type, a pair of hosts, a pair of 
ports, a pointer to a MIME type, a pointer to an application-specific attribute. 

20. (Cancelled) 
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21 . (Currently Amended) The method of claim [[20]] 6 further comprising 

subsequent to the configuring step, processing the latest interface definition document 
corresponding to the web service to determine whether changes to the configuration of the 
network traffic classification mechanism are required. 

22. (Currently Amended) An apparatus facilitating the classification of web services network 
traffic, comprising 

a packet processor operative to 

detect data flows in network traffic traversing a network; 
a traffic classification database operative to 

match data flows against a plurality of traffic classes, wherein each traffic class in 
the plurality of traffic classes is defined by at least one matching attribute; 
a web services classification module operative to 

identify web services in the data flows traversing the network; 

discover one or more web services based on web service invocation messages 
received at the packet processor; 

maintain a tracking data structure comprising, for each discovered web service, a 
web service identifier corresponding to the web service and a count of the number of web 
services network transactions detected in the data flows traversing the network; 

increment, responsive to a message indicating a new web services network 
transaction, a transaction count associated with the web service identified in the message; 

present, in a user interface, one or more of the web service identifiers and 
corresponding transaction counts, wherein the user interface allows for selection of one or more 
web service identifiers; and 

create, responsive to selection of a web service identifier, a traffic class in the 
traffic classification database for a selected web service in the data structure, wherein at least one 
matching rule associated with the traffic class includes the web service identifier associated with 
the web service; 
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receive an interface definition document defining the attributes of the selected web 
service and an operation of the selected web service; 

process the interface definition document to identify at least a first traffic class 
corresponding to the selected web service and at least a second traffic class corresponding to the 
operation of the selected web service; and 

create the at least the first traffic class and the second traffic class in the traffic 
classification database, wherein at least one matching rule associated with the corresponding first 
traffic class and second traffic class is based on one or more of the attributes in the interface 
definition document . 

23-24. (Cancelled) 

25. (Currently Amended) The apparatus of claim [[23]] 22 wherein the at least one traffic class 
is identified relative to the bindings identified in the interface definition document. 

26-30. (Cancelled) 

31. (Currently Amended) The apparatus of claim [[23]] 22 wherein, to process the interface 
definition document, the web services classification module is further operative to 

define a first traffic class corresponding to the web service; 

define at least a second traffic class corresponding to an attribute of the web service; and 
associate the at least a second traffic class as a child traffic class of the first traffic class in 
a hierarchical traffic classification scheme. 

32. (Previously Presented) The apparatus of claim 31 wherein the attribute in the second 
defining step is an operation of the web service. 

33. (Previously Presented) The apparatus of claim 31 wherein the attribute in the second 
defining step is a binding supported by the web service. 
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34. (Previously Presented) The method of claim 6 wherein the tracking list data structure 
comprises a hash table including one or more entries, wherein each entry comprises a key value 
and a transaction count, wherein the key value is generated by applying a hashing function to a 
host name and URI pair identified in messages initiating web services network transactions. 

35. (Previously Presented) The method of claim 6 further comprising applying one or more 
bandwidth utilization controls to data flows based on the web services traffic classes associated 
with the data flows by the traffic classification mechanism. 

36. (Previously Presented) The apparatus of claim 22 wherein the tracking data structure 
comprises a hash table including one or more entries, wherein each entry comprises a key value 
and a transaction count, wherein the key value is generated by applying a hashing function to a 
host name and URI pair identified in messages initiating web services network transactions. 

37. (Cancelled) 



PALO 1:104900.1 



